Caja itself doesn't make any "third party" distinction. It is a question of whether the host's policy allows access to external URLs in general.
That said, loading a large amount of code not written with the expectation of running in Caja might unexpectedly fail due to limitations imposed by, or missing features in, the Caja sandbox.